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Title: Traffic Collecting/Analyzing System and Method 
Abstract : 

Provided are a traffic collecting/analyzing system 
and a method thereof. More particularly, to a traffic 
collecting system that can collect and buffer all the 
packets transmitted/received in real-time while not 
affecting the speed of a network, separate them into a 
header and data, restore and store the user data into the 
original file by analyzing the header, process traffic 
statistically and store them, and allow an administrator to 
refer to the stored traffic, and a method thereof. 

The present invention includes a packet collecting 
unit for collecting all packets transmitted/received on a 
network; a packet buffering unit for buffering and storing 
the packets collected in the packet collecting unit; a 
packet separating unit for separating each of the packets 
stored in the buffering unit into a packet header and user 
data; a packet analyzing and storing unit for analyzing the 
header of each packet, retrieving the user data into an 
original file, processing the traffic statistically, and 
storing the packet header and the restored user data; and 
an administrator consol for providing the restored user 
data and a function of referring to the traffic statistics. 



The present invention has an advantage that when a 
company can properly cope with a security accident, such as 
leakage of confidential information, by registering what 
the information is about. Also, the stored information can 
be applied to other types of systems such as invasion 
detection system. An invasion shutdown system and the 
invasion detection system should be upgraded in preparation 
for new invasion patterns. However, the traffic collecting 
apparatus of the present invention can be operated 
regardless of the invasion pattern is new or not. Also, 
the present invention collects the generated traffic and 
the service starting/ending time of each IP by analyzing 
the header of an Internet Protocol (IP) packet on a network 
of an arbitrary IP. Therefore, it can be used quite 
usefully to figure out the data generated by one user's 
accessing the network from the service starting time to the 
service ending time. In addition, since the technology of 
the present invention operates a packet collecting engine 
and a packet processing server separately, it can minimize 
deterioration in their performance. Since it can store all 
data of packets, it can cope with processing the data 
collected in corporation with other systems flexibly and it 
can be expanded easily. 



WIPS PIView 3.3.2.5 





(19) Uit!-El^^o|§(KR) 






(12) Slf^SS(A) 




(51) Int. CI. 


(11) SJHSm 


^2003-0061666 


H04L 12/56 


. (43) SJHiiXK 


2003t307§!22gJ 


(21) 


10-2002-0002339 




(22) mm^x\ 


2002^011115^ 




(71) wmzi 














305-806 






cn2 oi^e 1^X1 m^^ximti^^^ ^sxis^iei 51143 




(72) VSR 














302-171 






□IS^^AIAH^^DM §320-46 


















300-080 






□12^^ Al^^^X-il §299-72 10/2 






&XH§ 












302-727 






CH2^^ A!AH^?LH§2Se0^ni-^6ei 108^ 


















305-328 






□ S^A|^£^§49-1 




(74) CH£|oj" 






(77) sJAI-St 3 






(54) fgg 







2^ 

S ^ V S^ Mas.' 4=2/^ AI^U gJ ^gOil a» 52^, ^61 Li|EO| B ^ £0| | g& § Dlxi XI 8J£^ 5F2AH *]A|^°^ f £/^<M£jfe 
EH^iOII □oH 4=2 §J WIH^ofOI, oj|CH2f AH§X!- EiiOlEi^ ^dloF&l, SiiCH ^^6101 AfgXI- GflOl EH « £1SH EhgJ^ ^ ^ XHSmDI, ^ 

s^i x-idio^oi oim xi&afm, ^eixpi- 5Ut ^ sf§ ^eh^ ai^^j §j ^goii soid. 



^ ^§8, U|^?-j 3^011 ^/4=£i £l^r EH3iM 4S5[b EH^l &}| M^l 4- 2 ¥ Oil AH =^g£Jb EH^ie tiHEH^5I~01 Xi§8^ EH^ OH 

iliU^; WiHiJ¥0il Sum XHSEIfe EH3L!M EH SIICH2F A^gXI- ^Ho^ EH^ ^W¥; HH^J ^"OilAH ^^^j z| eh^o, ^ 

CHM AFgXI- QlOIEiM ^^'o^Oj S EFgJ^ ^S8H2 ^2H^ S3lxH£l§ 4^SoFQ1, EH^ 5|ICH2[ £>Oi 4*«S A|-§X|- 

Q10IEHS XH&Stfe EH^i ^ » Xi§¥; ^1 £>Oi A[§X\ Gil 01 EH S X1lgSH2 ^BH^I S3II M^o^ ^dlXF fiSSKH 

SiCK EEs* ggj ^Xl Al^g§^ &s cfg gf|£] Al^gQilAH *0| XH&£! §Si »gfj 4^ 2iCK g£J x^B Al^gjOlU i^X| Al^gg 
AHS& liH&Oil Pjblo^Oi SnaiOiE 5hX| BSJLK &.tfSSI AH ^ li EH & oil &^2J0r§^ ^F^mCf. 

SE§[ ^ ^-HISI IPdnternet Protocol) U|^?H3^0||AH IP EH^^I o\\C-\m m^SKX ^ IPg AHbl^HJ Olg M^/m^ A|^| f ^BH^M 

^Aie.^^ ^SSKX. 6FU2J AFgX^I- Hi 3 0{| S^BFOI A|3|^ EII0IEIS 0|gA|^ Ajg^Ei §g Alg^XI EF^6F^Q| OH^ ^§5[ 
>i! OISI!"^ SACK £§.^4^8 EH^ 2115!^ Mil xiS-l AHbHg g£| SKM -^SotH^. .Sd|£| XioF«SJCH^ ^Xlo^ffl, EH^ °I 2^ 
.'QI0IEHS XHSoFHS QB A|^g]^2J ^eoilAH GilOIEiS S§1 ^hSCHI ^26f}il □ixHsFOi f^l ^§01 



CHH-£ ■ 

£2 .. ." 

EH^i tHEH EH1! Ul^o^ ^joi^X! 

g All AH 
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£ 18 M2H*i Al^gjOl ^§£Jb 21 

£ 2fe Egnsi A|^H2J LH¥ =?gm £A|S* 

£ 38 2^£lb HH^°j GilOlEi 521. 

£ 5^ hh^i B^m UEIUi^ he. 
s 6^ ma a»> eais <ie£. 

£ 78 MEH 3 ! GIIOIEH 3ESI ixfl £AI§! I§£. 



s 4*a/«*! ai^h §j chi ae 5^^, mm um&B. ^soii ass oixixi of si ah ^ Aizi^M. ^/^<ysj^ s§ 

flri^Oii CHoH §J WuiHofffl, SilQia A[§If CHI 01 EH ^ ^Elorffl, SilCH ^B r 01 ArgXr OR 01 El 5 ^I2H ^ gJ XI S SUM. e 

bh^i s^i xhei of oi oi-s x-i sal-en, ^ai ^mm 4= meh^ ai^u §j gjgoii ^§1- 510m. 

Ul^oja SLIEi^j AI^BS B\L{9\ TCP/IP EH^l Ell 01 El M ^SSSSMI, TCP ££r UDP S^CHI CH§! QIOIEHPm 

BEHU, U|M?-]3 ^£0j| g§§ OixIXI <&^m B\&M £/4=£l£j£f S§ 4*S5hffl EH^S! g^SFOI HH?L!2| ArgXI- CHI 01 EH 

■ SiiBrB gJ£H mSS ^S5H ^Aieio^ XHS6H ¥2, OlilJil XHSS Wfil^XI ^SISS ffg Jr^BMI EICL OjIS MOi, UIM?-iB 

SOI- ^OtOilAH 5j§SD^, 3I2LH e.S^ §S°J 2J¥ ^#0il CH 6H oHS ^ SI Pi X! 0]| am J\mW ^\ ^OiAH, SPi MB01I ^^6^1 

[Hit 401- 2m 51 01 a. 

PJEH^Hi- UIM?-IB 3i^°J BBS ^Ei ^CH£i ^^EH£ LAN (Local Area Network) 31 WAN (Wide Area Network)B^ S^6H, br^ SOU 2i^r 
g^EHxHg AhSK 4- 2i3HI 51 br CHI 01 EH £ £131 S^S 4* 2i>il 3 SICK o r X|°h 01 ^ OISI!^ ^E| S9i0| 

MS ^E, 1 Oil S]m Al^g Ef3J e£ SE© ^^1 OI^CHg ^ °lte ^ HI SOI ^SMI £j&C r . 

LHI^?HB M2h ^OtCHlAi, ggJ»B AI^H8 L-||M?-}B^0I| ^IHohfe 5H^f£jXI &8 §e2S¥9 LH¥ L-il^?-| B^Oll ^XH6f^ A|^ 

mmm s^rn^i ¥\m mu\± §j lhim?hb ^^oii ^-^e ui^^b g^pie 6Hg^a. o i eh & pi§s g afs ssafoi gEi^^^ 

L4i¥ LHI^^IBS mz\ M3\ti SSOI °l^U, LH^Af ^AIS E h 4= LHI^?HB ^2H^|°J til ^r^^B SAfS ofH^ X|£ 
AI3ID1 fe v 8 □^^OIIAHPi ^h^sh ^Xijgoi 2iCK g&'^XI Al^^8 SB XilCH Pl^e ^CHAHAH, UIM?-IB^2J EH?J §51 

6fB S£jn}|EH CHIOIE-imiOj^S Ir55r01 MS^PJ g^J i^XlHhCK • 

BEHLK LHIM^-IB SPJM ^tel e^H^] S^'irXI Al^gj8 IH^BI oil EH ¥^PiM ^^t^^^MH, L1IM?4B Ul¥°l ^I^Oj ^XHI 
CHE! CHIOIEH^r ^#£J2i^X| §^8I ^ 4^ ^ ^XilgOl 2iCL ^Hi^ CHi^g M5H §^^PJ AfgXPf ^l^ ^ AH g ^-^ofOI SJ^S R#tiiQ 
B ^§t IEH, 01011 CHsh B>IX1IAIM 5f0j, SPi MBS 4- SSOI ¥5d3Ml Si^ ^ SOI EL 



ttaOl OI^BXr 3rfe j&M 

HfB-UH ^ ^S2J =Sj8 UI^?-JB ^£0j| D|x|X| &£H| o^AH ^AIZIB^ ^/4^<^£i^ B8 W3±m ^ WnHgoFffl, EH^i^ 61ICH 

^^JSrOI 5H5i^ A^gXl- CHI 01 EH It 5^6^01 ^fiH Ef^^ ^^oH 4 l A|^o^ e^ni ^ S Ai ^g m g S§ xil^lrOII 2iCK 

^ Cf§ LH|eo| B ^ £03 | gs^g 0| xi XI 3T£^ or Pi AH ^AIZIB^, ^/4^^£|fe B8 IH^Oii Q\m 4^S ^ WEH^orffl, 6HICH2r 

ArgXr CHIOIEH^ ^£1 Br CM, 611 EH ^^o r 01 A r gXr CHI 01 EH # ^1 EH Er^^ ^ XH^orOI, ^£H^I S^l XHEI6F01 0|g XHSSrCfl. ^EIXF 

j\ 4- o\bz ^BH^'^S Al^gj ^ men-Oil SI EE ' 

0|E|Sh s^g Q£go[7\ 9im ^ U|eoj 3 Afo|| ^/4,Ai£ji= B8 HH^g 4S6fb HH^L! 4S¥; ^Ol HH^I ^S^OilAH 4-S£lfe EH^M 

bHuH^lorQI XH^oF^ WnH^]^; &J\ bHUH^l^Oil 9]oW Xi§3^ EJi^M MS! 51IEH£F ArgXr CHI 01 El S ^^6r^ HH^ ^^¥; ^Ol. nH^i ^ 
Oil AH ^ Hi5i^l 6ilCHS ^^3 r 01 f ArgXF CHI 01 EH S 5^3 r OI ©BHSJ HrS^ ^^loFB ^Bli^ M^lxHEiS 4-SS^OI, ^>0| ^^^j nH 

?i o1IEH£f &J\ Ar^XF Ef|0| EH S XH§6r^ HH^I ^ XH§¥; ^! fe^l A^gXKCHIOI EH B Xilge^B M£H^ e^l 51i D\^m M 

5or^ ^EIXF ±msm =?&9\^ 51 ^§2^ &CK 

BEIB = UIM^B^Oil ^/4^<^g^ £8 MfLiS 4^So r B, &OI 4-S£|^ EH^e bHUH 1^6101 XHSorOI, ^>Oj tH HH H 3 CH XH§£]^ M 

zim &mmt: ih^.^s ens!; m^i ^^ibm^eh ^^aoixi^ hh?jm bHUHHo^oi xngohoi, ^»^i mnH^scH xh&£|^ mzim m 

Ei£f ArgXf CHI 01 EH ^ ^#6 r ffl. gWS ^ SHfLl^l" ollEHS M^SfOj, ArgXf CHIOjEHS ^ib'3 r 01 ^EH^j 11^^ ^^lorB M2fi^} g^ilxHE! 

m ^mmw, mt-\& m^zi A r §x r chioiehs xh§o^ m^i zhei ah an; ^ mm*B mbj\ chioiehs sso^oi msmB 

S^l 2si ^l^# Xilgofe 51 El X\ Emm S^ofOI ^££!rr 5!§ ^§2§ §^EE 

BdlB ^ ^SS UI^?HB^01I ^/4^A]£i^ B8 M^im 4S6^ XII 1 E^i; &OI XHI 1 B 511 Oil AH 4^S£i^ SH^iM WUHiiBrOI XH^orfe HI 2 
SM; «5| HI 2 B^IOIIAH XHSSlfe IH?iS 61IEH2f A r §XF CHIOlEi^ SWSr^ XHI 3 BJ|; ^Ol HI 
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3 21 MUSI 611 CHS S^SFOl, 

&D\ AfiXf EllOIBiS £^loF0j SEjiBi EfiJ^ ^SoKQ MBHSj g^lxHdlS ^Sfffl, &D\ 2H 5i HI ^§19 A [§Xf GflOIElS XI S 

SFfe Til! 4 3! £>OI A'r§X[ QIOIEiS HI3613 E£H*i Sffl }|^# XilSSj-fe JHI 5 &7M 5 ^ of 01 ^^£J^ 2# ^§2^ § 

a. 



*S2| ^£ Si 5fS 
01 S blB*!© ^AIOIIS l¥el £Si S Sol 01 & Alio I gg^CK 

£ 18 & ^SHJ A|£iy0l SI ^£30|EL 

EH54 4*S 2j£!(103)8 LH¥ L1l^?4B(115)^¥Ei 2I¥ L||§9| 3(1 01 )(«|:S! H a)S ££J£li= 2^ EH34EK 2l¥ Ul M 313(101 )^¥Ei IH¥ Ul 
^513(115)3 HH^g ^S5f01 OIS X\X\\ HI 01 HWIOI^OII tH Si g|( Buffering) 61-01 H§o^ ( tHE1U£J^ §S§ »£l Ai tH ( 

iiDs aseo. h insists oisfe eh^ieh ¥^ se* oma Ahs» hioihwxi s»s)oii ashoi ^aizi ^sapi ?i5H/doia. 

EH^ 4*§ 2!!£!(103)8 Ul^?-I3 9JE|5||0|£ ^3(Network Interface Card), m 3 1- IE (LAN Card)^3^ ¥§J U^sm. EH^ B!S (103)21 
Ul^?-|3 °1EHE1!0I£M Promiscuous SES S^SIE^ ^§5101 LJI¥ Ul^?-1 3(1 03)#0II »2H EfU3 24i=r 2^ EH5JM 4-So^| SEL 

EH54 AHbH(11 1 )fe Wfti ^2 2B£!(1 03)3^¥E1 HH 5i B«S 3££i0H£j §fi§ 46I6[2, OIS Wffigi 8KH WEHiJ »o SWf 

DH^! on S!(1 03)011 A| HFS 2^ XIS3^ B!B A |£@ £±= xiBhS M&OU ai|&Ch EH5J xH ai AH bH (1 1 1 > CHI /dte EH ^1 Bfl£ §Si £^0H 

moi 2* nn^e oiicH a mex[ aioi ehs sai»o. 3EI3 hh^ xhei /HtH(iiDfe 3 miens s*i(^sixi ^£, £^£ mm s^(ftp, oil 
KS). ai^£ &mm m^mo\ mum sshskd ^hh a^xi- chioi&h mm^ ^msm, se^ such m^m mm mimm xhei 
in? s^iqioieib n§^a. 3 £.13, eh xh&i ah tH(n 1 )fe &d\ ^eis mt-\s$ a\^x[ chioi ehh xis&ch 

OIS °J6H, LH¥ m^?-l3(1 15) ^£0|| g^M 01x1X1 8t£^ 6FSAH MM?19.^, ^/^^1£1^ EH^2] olICH §S ^Ei" OfUSf AhgXf Gil 01 
Ei WXIE ^^2101 4^ ^^li £101, ^ElXfe ^dlXI- ^(113)21 ^I^M e5H. Ul¥ HI M?4 3(1 1 5) Oil AH MCHSI2 U^fe Oil SI, FTP^ 

^ai ^ n§i ^ tiw qioieis mzi.m ^ shq. 

£ 2^ S if SOII CEf^ ^eH^l 4S AI^S^J LH^ £A|§[ M^£0ICK 0I6K ^Ol £ §2E8fOj ^SS^IS §lCf. 

EJiei Pj!5!(103)g L4l¥ HI M^3(1 1 5)«0II •5HP-L1H EH5iM ^SSF^ EH5L! ^S¥(201). EH^M bHUigo^ QIOI Ei bHI 

0|^(207)OHi H§5lfe EH^i WfflS^(203) ^ QI0I El till 01^(207)011 Wffl^£l^ M3±m EH^i xH^i AIW(111)S 2^6fe HH 5i S^¥(205)^ =? 

EH5i 4^S¥(201)^ ^^'£1^ MZim S¥ ^SS^U, 3 m EH^M^ ^x.^ 40 h o, CK ^^i ^g«(201)^ M§ D\ 

&l EH^i IPtlntemet Protocol) OiSBJI^ ^l&l EH^l & IP CHH£ll^ EH^l 2^ ^^M^^ ^^ii S5101 ^ 

5 Ji aieh^o^ 4, S SMi SCK 3£I3 EH^l 4^S¥(201)^ 4=S§ EH^M EH^l tHni^!¥(203)^ S^ehO. 

HH^i tHHi^!¥(203)^ ^^1 EH^l ^S¥(201)^¥E1 EH^Me HIOI Eibll 01 £(207)011 tHmH3K)1 XiS^CI. OlffH, EH^ bHIH^¥(203) 

b ^ EH^i2J £J ¥^011 EH^i SOI SMS §¥5f3 mgJS ^^C-ji, SH42J El ^££1 Oil ^x^o^ AH uf^g ? 

^I^S^l A!^(0j|:1^&)§eh0l! EH^^ S^sjo^ H^'OH XH^^EK tH HI H¥(203)fe Olg^l AI2101 XI US EH^M XH 

sam n^g a§ sj^si n^oii EH^ig xism^ii oi s^i n^goi oisj ^h^^i- sis, eh^ tHmn 

¥(203)^ °H xHMOii H^¥El ^HISISAH P-Ai AH^g ^^8f3 EH^e XiSe^EK 

EH^i S^¥(205)^ EH1 01 El bll 01 £(207) Oil WH1lj£|fe EH^IS £?i!M S6H EH^ xHEl AH tH (1 11)^ S^^Eh. OlttH, EH^ S^¥{205)^ £§ A! 
Z.K0i|:1s) C{|0|Ei«i|0|£(207)Oll Uf^OI ^^£101 £lfeXIS SM^Ef. u^0| ^^£101 SH^L! 2^¥(205)^ ^^1 §¥ot01E 

EH5i°l SOI EF^M §-!0HM0i, EH^ xiEl AHti-l(207)M S^ehEK E^OI Q| 01 El till 01 £(207)011 £J££1CH 24X1 ^^£ICH SiEHEl 

£ H^Ojj EH^OI DlxH Q Xi^£10H 24X1 SOI- H^OI M^^£(Close) £JCH 24X1 ^23, EH^l 2^¥(205)^ CH^| ^EH^f SEK £^£i^ 
EH^2J £ 311} l^Eh EH^i ^^¥(205)^ £5i! OlgS^Oj EH5ie 24 CHI , S^ fc EH^l xH El AH W(1 1 1 )»2| £51! 9JEiEll 

0I£^^ SOHXMI EIS, SH^! S^¥(205)fe &l^oHAH £5ii S^S A|£6^3, £^01 2§£1S DAI U^M 2^^EK 

EH^ XHEI AH tH (1 11)^ EH?j 2!*J (1 03)^^¥Ei S^SICHS EH^M ^ ^OhAi Q| 0| El bHI Ot £(21 1 > CHI mm§6K)4 XI § 6^ EH^l ^J^/m 
E-)^¥(209)2[, CHI0IEIbil0l£(21 1)011 tHui^SJ^ 2| EH^M 611 EH ¥^HF A^gXI- Gil 01 El ¥^°^ ^^5[b EH^ ^^¥(213)2K ^ v EH?4 

21 6|| CH ¥^§ ^^SfOI A^gX^ EROIEI ¥^M £^6^3 OIS £!8Jl°i ^SISHM. MBH^I S^l xHEIS ^|§o^Oi ^£H^ §311 XH§ 

5^3 ^^1 EH^Sl SUCH ¥^E[ AhgX^ CHIOIEH ¥^M XigS^ EH^i 8^/33 9¥(21 5)^ ^^^EK 

EH^i °'^/WE^¥(209)^ EH^i 2112(103)21 M5i 2^¥(205)^¥EH 2^£l^ EH^e £J ^ ^OUH CHI 01 Ei bil 01 £(21 1 > CHI Hi El got 01 XI 
Se^EK EH?H ^1^/tHEH ^¥(209)^ EH^OI ^d£IS(401), ^^19 EH5LI0I i§9 JH 4^(0j| : 1 0000 3H) 01^21 XI S ^M§[EK403). 4=<^^ EH^OI 

JW^ 01^01 01 LIS, EH^i gj^/WIHS¥(209)fe EH?im E^Oll XI S BO(405). EH^IOI ^§€1 ^ OI^OIS, EH^i 

E-l^¥{209)^ XHSeSl EF^g ^3 AH^^ E^M ^£^EK407). 3dl3 E«?4 gj ^/W El g ¥(209)^ 4^^ EH^M AH^^ S CHI X1§re[Q(4 
05). (E 4-S2S) 

EH^i ^^¥(213)^ QlO|ElbllOI£(211)0il WEl^Sl^ ^ EH?i#-5llEH ¥^5F AFgXI- EilOl EH ¥^3^ ^WelQ. EH?i ^^¥(213)^ QlOIEHbil 
0I£(21 1)011 Jim XI & EI^^EIfi ^^m3(501), WEigSI^ ./file EI^SEIS Aia(0||:1OS)0m 2UHH SCK503). 3EI3 EH!1! S 

W¥(213)^ ^XKS^ EF^OI ^§ ;H^(0jh10, 000^)21 EH^OI XI S 50IS, 511 & E^M 3B^EK507). 01^311 oH AH 2gS E^^¥ 

E! ^ EH^Oll ^¥£101 24^ ^Oi§S °!§^l EHIOIEHS ^ OH MOIS, 01 CHIOIEH^ SFU2J EH^2I ¥£S i^^l 3D. EH 54 ^W¥(213)^ 

*i EH5J2J IP 5ilEHS ^#5101(509). EH?40| TCP(Transport Control Protocol) ^^^^011 6H93>E*(51 1). EH5J3^¥El TCP ollEH2f AigXl Gil 
0IEi« *«&CK513).(£ 5 S^£) 



2003/11/4 



3 



WIPS PIView 3.3.2.5 



HH^i S*J/XIS¥(215)te 2* HH^S] 6IICH S*JSQ. 3EII> EH 5i ^ Al-SXj- CHIOI Ei S^joKM 0\M ^EH 

2J ^^eiCK SE» HH?J ^/XH §¥(215)rz SoH. ^E-IX^f SJ^, fig £^ Xlgeh 312! ^ AIZ}Hj g^lfi ^ 2i£ 

^, meu^i mx\ xheis ^sshoi ^eh^i s^ii §s§ xhs^ck nuei ^^/h§^(215)^ ^ ih^hi such ^gaf Afgxi- chioi 

Ei ¥fi XiSShQ. 

mil ^^/x-]§¥(215)^ ^eh^i S3i hhjsi b^uf u? 5>h xi xi <&h, ^dio^i sei oh^ ^ jhhj n^g ^^of^i s^chi, ooai oo 

^ m Jt £3S£(601), AH^g MEH^ S^l m^m 01(603), h2H^I S3! EIIOIEHM XH§ £§3X1 &o 2(60 

1), 3fl ^^£]Oi°i^ ufgJOj! ^EH^l #31 CHIOI EH« XHS^Ch 

nH^ ^/XH§¥(215)^ SH^HJ 6IICH M^eJ- 33^ Finish IH^!0I2(605). Memory SZie S3 It! 5hC^ QAI AfgiJ- 4^ SMI Si- 

ll. Finish HH^OI 0fU£(605), 4£J AI3 01 ¥g SAh»CK609). 

SUSi °£ Ah^[ 609B3IS 4*SShte Oi^g gg8|-a, ojyajo^ ^Aj^oilAi CHE1 EHJOIU CHI 01 EH S 2^ CEH g^EI^ 01 HfgJOlU 3101 
EHS UIM^-JB &EHU gSEi^f 4^ mmo[0\ mmB 2*2*2| CHI 01 EH Oil oj|CHM MO} AH 2 ^8^1 £|i=rCH!, 01 HH SSEife 

*£!^0I|A| SfcH EfgJOlU CHIOIEHHJ HOI CHCieiXI ^ gi^l IH^Oil W3S ^ 6PI ?i5f01 is oil AH hi SLH^ OHI^ HH 

5! 2| ollCHOII Finish HH510IBHQ 43 BEO(?«»)« 3I46KH ffHSOm. 

SH, Finish EH^i SAH gSHAH 6HS 4^01 ^ = £12*^X1 HBoM! SI^CHI SH ^! 3| 2^ £f Finish packetOI 3 1 El- ^Hl ffH^ 

Oil 4£J£IX| 8fe 3^31- SICK 01 CEH ^£]^0IIAH 0! M^im 9\o\\ WIS 2.1 S^g s^lsf oh XI ^feCfS AIZ.^01 Xik v 4^ Oil S El 

geiOl g^i 3 OH Al^gOl §X|o^b S?^ ^^SC[. OISIM ^XIoPI ^ISH ^^l CH^I AI^M ^§oH 01 Al^ LH CHI Finish EH510I 

xi a h e ^¥(609), bi§4 h is xheis s^oi af§8^ sie oiieai ^?}m e^(6i d. dai a^^ 4 21^1 

4^3^ m^im^ qb m<M°\ ehioiehmoick m, & ui^?hb Ej-eioiife =4^^ a^moi ^aioii a^o^ m^ow om 

CHIOIEHMOl ^XHSUl ZlCl OI.AI^ljOilAj^ OlEHsh M^M §011 HF^OIIAH ^EI^J HH^MXIIEI SOUH B[L\9\ u\W^ J\\m% v m 
01 °hCf. 01 OH Hh s CHI AH ^EI3 S °H XHM ^4>ij£j 5H?i 01^(61 3), 0| HH^Oll allCHSf CHIOIEHM Xi&l^ Hf^i e!Q(615). 

OIQI 6HS HfSJOl ^EH0I3(613), ^XH A[§5U WIS El Oil ^^helCK617). 

EH^l g^/XIS¥(215)^ 4^12} HH^i 511 EH ^^0| &^£J2 r S^l ^ E^M XHS^CK621). 

g a.goj ^AionoiiAH, ^eh^ mow m^m 9\m mo.m m^s o\d\ <s i>hf ira. 



[H 1] 



SI- s 


HI 01 


NO 


MEH^! my\ u^Oll Writing ^4^(1^1 m?\) 


Packets 


m ^4^(1000:H Bfl g^) 


Files 


^y^9 m mm ^(^) 


Normal 


§m e ^ =4(^p^) 


Abnormal 




Open 


^JH OH 4^ 


Time(sec) 


AI^KUNIX TIME) 



sh^i <s 2>fe s ^ai oil oil Eiai Meoai ssi qi oi &i 3i niaoii »§£ib m otie ewsci. 



[S 2] 



NO 


Packets 


Files 


Normal 


Abnormal 


Open 


Times 




1000 


310 


302 


0 


8 


989506827 


,2 


2000 


619 


611 


0 


8 


989506857 


3 


3000 


942 


935 


0 


7 


989506888 


4 


4000 


1256 


1248 


0 


8 


989506914 


5 


5000 


1582 


1574 


0 


8 


989506970 


6 


6000 


1905 


1897 


0 


8 


989506997 


7 


7000 • 


2214 


2208 


Q 


6 


989507031 


8 


8000 


2529 


2521 


0 


8 


989507078 


9 


9000 


2833 


2831 


0 


2 


989507112 


10 


10000 


3138 


3134 


0 


4 


989507159 



HH^ S*i/:XHS¥(215)fe ««S ^ Wl!°l SlICH ¥^3f AF^Xf CHI 01 EH CHIOI EHtfllOl ^(21 1 ) Oil Xi&ehCh 

^di XI- e#(113)S CHIOiEH«i|OI^(211)0il XHSS M£K mmS 2.EolO\ ^ElXfOil^l Ii\£om, CHIOI EH Ul 01^(21 1)011 XH§e ^BH^ §311 CHIOI 
EHS 4= °^CK ^2J|Si g^j ^Hf^ g^^^ Xi§£|^CHI, ^El XPI- WQm CHI 01 EH M Md^^l ^'^6^(701, 703), 2hE| XI- 

^#(113)^ 8Hg£j^ ^EH^ mm CHiOIEH u^M ^2th 3IZ_^°}2J S^l S3FS ^l^ohOI l^S #^e!CK705, 707, 709, 

711). 

o^l <S 3>8 M2H5| S^l CHI 0! EH H| 5UI ¥loH. ^El X^F gj^ Al^lb StSI SJ die UEiyiCh 
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[S 3] 





a/si/n 


AI/^/S ! 




20010501 


010100 




20010531 


240000 



&j\ £ 2oiiAi caoiaunoi^(2iDt %q mx\ ai^b(£ais^i %m.)ou ^mm 4 aa. aoiHHioi^(2ii)oit ms9i3(ii5) aoii 

HUeiSI oilCH ¥^0l ElteHI, #31 US UXI A|^g]2j SUCH ¥16H AhSHOi SCK S WHS e^ia ^S/^ Al^iJ^ S 

gXI Al^USj AH" Al^g^^c #g mfeoFD. 

£ ^ Al Oil CHI AH fe. 4>3/S*i AI±S0| DH^i =£S 2«5!(103)^ EH^ xHEl AibH(111)^ ^E|£]0i <&±= ^SOID. Olfe All 01 ¥ (CPU) 

S U^CHA-i ¥§H gbHS>D1. flH^ 2113(103)01 IHI^?4 3(1 15)^011 ^/^£J£lbr EH^M M Xl XI ^SBfE^ 3h^| ?mOiCh 



ca'^Ai ^ ^go Li |Eoi 3 ^£oii gge oi xi xi <%^m s\&m siai^s, ^/^£J£i*= hh ^ chi ch& 4S§m oie wmgistH aims 
ms» aioiEis sasna. si a ^^mo\ afsxi- chioiehs ^bh nms m& si hssnji. ^sh^ s^i xnaiofoi ois us sum ^eixi- 

3|. 5tlt ^ »01 f HSSfe SfiM^ 01 EH ^hX| ^OtOilAH #-g ZHfeSMI ga. 01IS MOi, 31 S LH §211 §SS| 2J¥ £«0|| CH6H 8H 

S §W ^S±oix|0|| QloH 31^ D^olW Sov AH10II ^^5^1 CH§tt 4^ SL!§0| SiCK SE£! ^X| AI^BSj* «g QB m^S\ Al 
Oil AH &D\ HSS §S1 fit 4* 2iCf. H£J XfEh AI^BOIU SEJ gX| Al^iJg AH^g S S IIH & Oil DiUlolOj 2Zl£ilO|E o>X| &X| 8J 

SE» S ^SS gj2j°J IP(lnternet Protocol) L||M9I3#0||A| IP uH^^I 6IICHM ^*1ofCH ^1 IPS AHbl^SJ 0i§ AIS.7SS A|2|. MBU^m 
£A|2}oS 4*S3K)| f AfgXPf LJI^-13011 9*610) tfgl Al^lte EH 01 El ■ OISAI^ AIS^EH AISWM U^o^GII 0H¥ ^goh 

IHI 01 §1 4= 2iQ. 

ccs i- g ^go nil 5i ail x! 21- IH^ xHEl AHhHS ^ElolOj §t!12| Xi 3[M £IP°1 ^Xlol-ffl, EH5J°i 2^ DHI0IEHS X-jSofH 

S A|>:ii^2| 2S01IAH ^S^l QIOIEiS g§l ^gdl #26^1 CHxHo^ffl ^Til ^&0| J[^B[L[. 

(57) S?2| 

a?» 1. 

A^j hh^i ^S^CHlAi 4S3b Iffl^M tHm^ShOi XH S-Shfe IH^i tHH^¥; 

bHW^¥01l °ioH X-i§£l^ KH^e HH^i oil GH AFgXh LHI 01 EH S ^^6^ Mil 

nHBi ^^¥0ilAH m^'B ^ EH^Bi SilEHS ^^6f04, AfgXF CHIOIEiS S^o^Oj ^EHEI ^^o\H ^Eli^ e^xHEIS ^SaFW, ^ 

^i hh^ oiicHst- ^oi mm'tB Ai-gxi- aioiEis xh&b^ ieh^i ^ xhs¥; ^ 

av^| A}-gXF GII0IEIS XilSS^ MSK^I S3I 5§J ^I^M XHISahfe ^eixf eir 



S?g 2. 

UI^?-|B^0il ^/4^^£l^ 2E EH?ie ^^1 4^S£I^ M^im Wm^o\0\ XI S of 01, hH GH S CH Xi§£|^ SHJJM S^6hfe MZ! 

ao | HH^i oyxio^ ¥E ^ S^£|CHX!^ HH^e Wll^ofOI XHSohOI, ^^1 hHuiUSCH Xi^£l^ 6HI CH S> Al-gX}- CHI 01 EiS ^^Bfffl, 

a^i «3ei 2| eh^ioj ancHM ^^mOl, A[gX\ CHI0IE-IS 5^loF01 EfiJ^ ^^o r ^2 ^2H^| S^lxHEIS -MyBfDI. ^|CH2f 

a^j AfgXf Gil 01 EH « XHSof^EH^ xH El AHbi; S 

ao| ^^Jg AfMXI- Oil 01 EH M £&6l-^ XI|gS^ MBH^I S^ll ^I^M XllgSfe ^ElXf e# 



g^S 3. 

msflaaoii ^/^d£i^ ih^^ 4S6fb n\ 1 b»; 

&OI All 1 E^IOilAH ^Sab HH^IM bHE-i^mW XHSotfe HI 2 E^l; 

^^l HI 2 E^IOilAH XH&£i^ EH^e SilCHSI AfgXf Gil 01 EH S ^#S^ XHI 3 B^l; 

ao| XHI 3 E^iOilAH ^^E! ^ Eli^Hl SilCHS ^^5fCM, ^Ol AhSX r CHIOIEiS SgStOI SBHHJ ^5H1 M2ji5i #^|x-lEIS 4^S6F01, 

^Pl IH^Hf ^Ol AfgXf CHI 01 EH S XH^ol^ XHI 4 E^l; <k 
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soj^i m§I[ G1I0IEH-B HS3H2 =2H^> g^i £ffl }|^# fllgofe HI 5 &3! 



•9 
£3 1 




115 



PC(107) 



Mil 4= 
(K 


§ 2HS 
)3) 






AltH 

(111) 






(113) 



L^d £1(109) 



• • • • 



2 



FROM 
me*|3<115) 



(201) 



(203) 



103 



(205) 



0101 Q 
HilOl^ 
(207) 



111 



(215) 



(213) 



(209) 



□loia 
mioi^ 

(211) 



TO SSJgXJ 
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£2 3 



EH 5! 4*2 2!2(HI/d Server^ SUife packet ^£ 



Oil 01 EH ^01 



01 01 EH 



c-ii oi eh a oi 



QlOl EH 



OB 01 EH SOI 


IP Header 


TCP Header 


Payioad 


2 


20 


20 


Payioad Length 



Packets Ail ^ ^ £ 
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